



|
Post by TicMan @ 03:38pm 27/06/08 | 36 Comments
![]() A press release from Blizzard show that it will be available for US$6.50 from their online store. IRVINE, Calif. –- June 26, 2008 -– Blizzard Entertainment, Inc. today introduced an optional extra layer of security for World of Warcraft®, its award-winning massively multiplayer online role-playing game. Designed to attach to a keychain, the lightweight and waterproof Blizzard® Authenticator is an electronic device that generates a six-digit security code at the press of a button. This code is unique, valid only once, and active for a limited time; it must be provided along with the account name and password when signing in to the World of Warcraft account linked to it.promoted forum item
|
|
Posted 04:24pm 27/6/08
Posted 04:31pm 27/6/08
Posted 04:38pm 27/6/08
Kind of like a gaydar, so you can identify other wow players in a pub and hit on them.
Posted 04:42pm 27/6/08
Posted 04:46pm 27/6/08
Posted 04:53pm 27/6/08
Posted 04:56pm 27/6/08
Posted 05:04pm 27/6/08
Posted 05:14pm 27/6/08
Posted 05:40pm 27/6/08
WiFi or something?
Or is it just a random generation based on a set of algorithms and any generated key works?
Posted 05:55pm 27/6/08
i guess its needed
wow player seem to love going to dodgy websites that install keyloggers, leaving them with their accounts haxed
Posted 06:33pm 27/6/08
it works by the token and a box at blizzard being synced.
so before they issue a token they sync it with the box in their server room, so that box knows what number is going to be displayed at any given time by the token because they have two things in common, a clock differential (ie, how many ticks the tokens clock is from the hosts on clock) and an algorithm to run the time through to generate the token number.
Posted 06:43pm 27/6/08
So it's a bad idea to use it in space?
Posted 08:00pm 27/6/08
Posted 08:15pm 27/6/08
Posted 08:17pm 27/6/08
Reason for this I guess would be people losing their accounts to keyloggers finding their password.
One of those annoying floating keyboards not good enough? I dont know.
Final Fantasy XI (yes, I still play it) uses a floating keyboard now. They have recently had a huge spade of account thefts (they say) as a result of keyloggers on user machines.
Also, i've met some people that would hold their WoW/AoC/FFXI accounts more dear then their bank account... Which would be the ones that RMT would target I suppose.
Posted 08:51pm 27/6/08
Posted 09:12pm 27/6/08
Posted 10:10pm 27/6/08
Posted 11:06pm 27/6/08
well, the token generated code changes every 5 seconds, so you have a 5 second window to be correct in. once the clocks drift 5 seconds i guess you are in trouble but the tokens do have expiry dates of around 2-3 years.
Posted 11:26pm 27/6/08
Posted 11:42pm 27/6/08
gonna cost u an extra few seconds each time u log in
Posted 11:53pm 27/6/08
1. You enter the code
2. Server goes "hmm, that's not the code, but it's the previous code, so I think you need syncing - please tell me the next number you get"
3. You enter the next code
4. Server goes "ok, that's the next code, I'm resynching you to 'Now'"
Requires no phone call, exchange of product or additional purchase.
As weird as it is having a token for a game, this is tempting for just $6.50.
(not that I go to dirty web sites that could install keyloggers)
Posted 11:59pm 27/6/08
and i believe Commonwealth went the way of a Mobile SMS code system or similar.
oh, and OT but suncorp metways mobile banking is awesome, was away on holidays pretty remote place, had barely 1 bar next-G, but was able to do all my weekly banking by mobile.
last edited by 3x0dus at 23:59:48 27/Jun/08
Posted 11:57am 28/6/08
Posted 01:03pm 28/6/08
Posted 01:33pm 28/6/08
Posted 06:42pm 28/6/08
Posted 06:53pm 28/6/08
Posted 08:19pm 29/6/08
Posted 11:19am 01/7/08
Posted 12:00pm 01/7/08
Posted 01:02pm 01/7/08
I got one from suncorp and it just adds that third layer of auth
rather than having to guess my username/password combo, now a phisherman would also have to know the security token which changes every 30 seconds (but is valid for a few seconds after it changes to the new one)
ie. when you type in your username and password sometimes you can see that the number is *just* about to change (little count down thing no unlike bars of reception on a phone)
but it will still let you login even if you click submit once it has changed (for 5 seconds or so tops)
my guess is that this would compensate for the drift effect given that;
if it failed and you just typed in one code that changed straight away, you're likely to just go and try again with the newly generated 6 digit code - and it should be successful, this in turn allows for up to say 15~ seconds of drift (shitloads)
its just a random number generator that has a salt for each unique token, the server would also know the salt which is attached to the username on the blizzard auth servers and therefore it can generate your code at anytime to use as a checksum
Posted 11:25pm 16/7/08
Posted 09:00am 17/7/08
Its not a stupid idea.
Posted 09:22am 17/7/08